charter drift: declared .sln/.csproj paths in '## Files to modify' are not matched → recurring false-positive scope expansion

[montfort]

Summary

Field report from the same adopter as #345/#346 (greenfield .NET 10 / Rust CRDT library). straymark charter drift reports declared .sln and .csproj files as "Modified but NOT declared (scope expansion)" even though they are explicitly listed (in backticks) in the charter's ## Files to modify table. The parser silently drops them from the declared-set. This has recurred across three charters (CHARTER-01, -03, -04) and forces a manual "parser-FP vs. real-expansion" triage at every close.

What happened

CHARTER-04 declared these rows in ## Files to modify:

| `src/Weft.Server/Weft.Server.csproj` | New — ... |
| `tests/Weft.Server.Tests/Weft.Server.Tests.csproj` | New — ... |
| `Weft.sln` | Change — ... |

straymark charter drift CHARTER-04 --range <declaration>..<implementation> output:

  Declared: 10 files
  Modified: 16 files

INFO: Modified but NOT declared (4 files, scope expansion):
  - Weft.sln
  - src/Weft.Server/Persistence/DocumentStateFraming.cs
  - src/Weft.Server/Weft.Server.csproj
  - tests/Weft.Server.Tests/Weft.Server.Tests.csproj

Of the 4 flagged files, only DocumentStateFraming.cs was a genuine undeclared addition. The other 3 (Weft.sln, both .csproj) were declared but never entered the parsed declared-set — note Declared: 10 when the table had 13 path rows.

Root cause (hypothesis)

The declared-path extractor appears to use an extension allowlist for "code" files (.cs, .rs, .md, .yaml, …) that omits build/project files (.sln, .csproj).

Earlier field notes (CHARTER-03) attributed this to "root paths without a /" (Weft.sln) or "adjacency to a sibling such as Program.cs". CHARTER-04 rules both out: the .csproj paths here DO contain / (src/Weft.Server/…) and are not adjacent to any matched sibling, yet they still fail. The common factor is the extension, not the path shape.

Why it matters

• Recurring false positives on every .NET charter that touches the solution or a project (CHARTER-01, -03, -04). The operator must re-triage parser noise vs. a real scope expansion (DocumentStateFraming.cs) at every close.
• Erodes the signal: if "scope expansion" always ships ≥3 FPs, it gets normalized — and a genuinely undeclared change can slip through unnoticed.
• Bidirectional: because these paths never enter the declared-set, they can neither be correctly matched as declared-and-modified nor surface under "Declared but NOT modified".

Proposal (any subset)

1. Extend the extension allowlist to include project/build files: .sln, .csproj, .fsproj, .vbproj, .props, .targets (and equivalents in other ecosystems).
2. Better: stop filtering the declared-set by extension entirely — treat any backtick-quoted token in the table's first column as a declared path. The charter already marks the path with backticks; that is the explicit declaration.

Context

• Adopter: StrayMark fw-4.21.0, CLI 3.30.0. Same adopter/repo as audit-prompt: guard against generating the prompt on unstable state (CI in flight / dirty tree) — adopter field report + remediation #345/followups drift --apply: extracts resolved/duplicate '## Risk: R<N>' sections as open follow-ups; misses explicit '## Follow-ups' — adopter field report #346.
• The registry/telemetry flow otherwise worked well; the friction is purely the drift path-extraction heuristic.

[montfort]

🔗 Filed as part of Weft's StrayMark adoption — cross-linking to the adopter registration discussion: #357 ([Adopter] Weft). Per the adopter-feedback commitment, findings link back to that thread for traceability.

[montfort]

Fresh reproduction — CHARTER-06 (4th occurrence, this one closing US3)

Independent data point that pins the extension-based root cause cleanly, plus a generalization ask from the operator.

CHARTER-06 declared 12 backtick-path rows in ## Files to modify. straymark charter drift CHARTER-06 --range origin/main..HEAD:

  Declared: 8 files
  Modified: 13 files

INFO: Modified but NOT declared (4 files, scope expansion):
  - Weft.sln
  - src/Weft.Server.Persistence.EFCore/Weft.Server.Persistence.EFCore.csproj
  - src/Weft.Server.Persistence.Redis/Weft.Server.Persistence.Redis.csproj
  - tests/Weft.Server.Tests/Weft.Server.Tests.csproj

The arithmetic pins it: 12 declared rows − 8 recognized = 4 dropped, and the 4 dropped are exactly the 3 .csproj + 1 .sln. The 8 recognized were 6 .cs + tasks.md + an AILOG-*.md glob (the glob matched fine). Zero genuine scope expansion this time — 100% of the "scope expansion" output was parser FP. Fourth charter (after -01, -03, -04) with the same signature, and it re-confirms the cause is the extension, not path shape: these .csproj contain /, Weft.sln does not, and both classes fail identically.

Generalization ask (per operator request): audit the allowlist against popular ecosystems, or drop it

If the fix lands as proposal #1 (extend the allowlist), it has to cover more than .NET — otherwise the same FP recurs for every non-.NET adopter the first time a charter touches a manifest/build/lock file. A non-exhaustive sweep of files a charter legitimately declares:

• Rust: Cargo.toml, Cargo.lock
• JS/TS: package.json, tsconfig.json, pnpm-lock.yaml, yarn.lock, package-lock.json, .eslintrc
• Go: go.mod, go.sum
• Python: pyproject.toml, setup.py, setup.cfg, requirements.txt, Pipfile / Pipfile.lock
• Java/Kotlin: pom.xml, build.gradle, build.gradle.kts, settings.gradle
• Ruby: Gemfile, Gemfile.lock, *.gemspec
• Extension-less (these defeat any pure-extension allowlist): Makefile, Dockerfile, Gemfile, Rakefile, .gitignore

The extension-less cases are the tell: an allowlist keyed on file extension structurally cannot match Makefile / Dockerfile / Gemfile, which are among the most commonly declared build files. That's the strongest argument for proposal #2 (treat any backtick-quoted token in the table's first column as a declared path, dropping extension filtering entirely) — it is ecosystem-agnostic by construction and immune to the "add one more extension" treadmill. Suggest a deliberate review pass across the ecosystems above regardless of which proposal is chosen, so the fix isn't silently .NET-only.

Context

• Adopter: StrayMark fw-4.21.0, CLI 3.30.0. Same repo/adopter as the report above; CHARTER-06 closed US3.
• Documented adopter-side in AILOG-2026-07-13-002 §Additional Notes (flagged the FP as non-drift so the close stayed honest).

[montfort]

🔧 Fix en camino — PR #364 (rama `fix/charter-drift-path-extension-allowlist-354`).

Enfoque: propuesta #2 (soltar el allowlist de extensiones). El extractor de `## Files to modify` (`straymark_core::charter_files::looks_like_path`) ya no filtra contra una lista fija de extensiones de código. Ahora un token en backticks cuenta como path declarado cuando:

• referencia `.straymark/`,
• contiene un separador de directorio `/`,
• lleva una extensión con letras (`Weft.sln`, `Cargo.toml`, `.gitignore`; un sufijo puramente numérico tipo `1.5` no cuenta), o
• es un archivo de build sin extensión conocido (`Makefile`/`Dockerfile`/`Gemfile`/`Rakefile`/…).

Agnóstico de ecosistema por construcción — sin el "treadmill" de agregar una extensión más. Los tokens con espacios (`cargo build`) o sin forma de path (`risk_level`) se siguen rechazando, así que el guard original se preserva. El mismo extractor alimenta el parser de AILOG `## Modified Files` y la regla de validación `CHARTER-FILES-EXIST`, de modo que ambos ganan el reconocimiento ampliado (el punto bidireccional que señalaste).

Barrido de ecosistemas (por pedido del operador): los tests de regresión cubren manifiestos de .NET (`.sln`/`.csproj`), Rust (`Cargo.toml`/`Cargo.lock`), JS/TS (`package.json`), Go (`go.mod`), Python (`pyproject.toml`), Java (`pom.xml`) y archivos sin extensión (`Makefile`/`Dockerfile`/`Gemfile`), más un test negativo que confirma que prosa/comandos/versiones no se cuelan.

Verificación end-to-end con el binario release reproduciendo el escenario exacto de Weft: `Declared:` pasó de 1 → 4 archivos y los cuatro paths `.sln`/`.csproj` ahora resuelven como declarados-y-modificados → `OK No drift detected`, en lugar del falso scope expansion.

Versiones: `straymark-core` 0.9.0 → 0.9.1 y CLI 3.36.0 → 3.36.1. Disponible vía `straymark update-cli` una vez que se etiquete `cli-3.36.1`.

Cross-link a la registración del adopter: #357.